“On the Mac, pictures are no longer saved directly in your Documents folder as they were in previous versions, they are somewhat more hidden in your user Library but still not encrypted. Any files sent to you are saved in /Users/[your account]/Library/Containers/com.savoirfairelinux.ring.macos/Data/Documents/. If you delete your Jami account the files are not deleted. If you then add a new account, any files sent to the new account are also saved in this same directory. So you now have files sent to multiple Jami accounts saved in the same directory together, with no encryption or other controls to prevent access.”
“While the Android client does not appear to leak files (none that I could find) the Mac version saves files sent to you in your user Library. This makes this app insecure for anyone using the Mac version or sending to someone else who is.”
Has the security issue with macos been fixed by now? I find it really sad that such a great and promising peer to peer cross platform software is not being recommended by messenger comparisons because of this flaw.
There is two cases for Jami on Mac OS. Choosing the appstore or the version from jami.net
The version from the appstore will use /Users/[your account]/Library/Containers/com.savoirfairelinux.ring.macos/Data/Documents/ that the user can’t change and jami.net the directory you choose in the settings with (where downloaded files will be stored like a web browser). Generally the files are protected by the system policies (like partitions encryptions, containers, etc).
Major changes are coming, such as swarm (Swarm: a new generation of group conversations). This new feature modify a lot of things and the file transfer is completely re-designed. So, for the review, this sentence will be no longer true:
If you delete your Jami account the files are not deleted. If you then add a new account, any files sent to the new account are also saved in this same directory.
files will be located per conversation. So removing the account will remove the conversations and the files. However, the user will have the option to export the file to a choosen directory.
I assume that the review’s author labelled that as a security issue for a valid reason. It implies that someone using the same computer’s session could access the files without having access to the Jami account since those files are left unencrypted in the files system by Jami.
I also assume that other well known privacy centered messengers mentionned in this review, unlike Jami, do address somehow this security issue since the author doesn’t mention it in their reviews.
Good to know that Jami keeps getting better. I guess some form of encryption for local files would be another welcome upgrade security and privacy wise
I do not regard the current behavior as a flaw because encrypting received images would conceal them from the local file system, so then you cannot preview them outside of Jami or search by image content using Spotlight [which is supported on Apple Silicon Macs]. If you need more security just activate FileVault (the Mac OS disk encryption utility).